Adobe · ColdFusion
CVE-2024-20767
ColdFusion | Improper Access Control (CWE-284)
What it is
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
CISA: Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: January 6, 2025
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| Feb 24, 2025 | Deserialization | ColdFusion | Critical 9.8 | 91% |
| Jan 8, 2024 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | >99.9% |
| Jan 8, 2024 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | 97% |
| Aug 21, 2023 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | 17% |
| Jul 20, 2023 | Improper Access Control | ColdFusion | High 7.5 | 99.8% |
| Jul 20, 2023 | Improper Access Control | ColdFusion | High 7.5 | 99.8% |
| Mar 15, 2023 | Deserialization of Untrusted Data | ColdFusion | High 8.6 | 97% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.